{"id":"CVE-2026-116270","kind":"vulnerability","aliases":["CVE-2026-116270"],"related":[],"title":"Perl MIME::Words: repeated encoded-word markers exhaust memory during mail parsing","description":"MIME::Words versions before 5.521 for Perl allow memory exhaustion via repeated \"=?\" sequences in decode_mimewords.\n\nFor each \"=?\" that does not start a complete encoded word, decode_mimewords appends an error message containing the whole input string to $@. A boundary of 8,000 \"=?\" pairs (16,000 bytes) adds 8,000 copies of itself to $@, about 128 MB.\n\nFrom version 5.518, MIME::Parser decodes every multipart boundary this way, so a remote sender can exhaust the memory of the parsing process with one Content-Type header.","summary":"MIME::Words before 5.521 appends the whole input string to an error variable for each malformed \"=?\" marker, so a crafted header multiplies its size. From 5.518 onward MIME::Parser runs this on every multipart boundary, so one Content-Type header from a remote sender can exhaust the parsing process's memory.","severity":"medium","cvss":null,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["email-parsing","mime-tools","package","perl"],"not_affected_if":["no-untrusted-mime-input","versions-before-5.518"],"how_to_check":"- Run `perl -MMIME::Words -e 'print $MIME::Words::VERSION'` or `cpan -l | grep MIME-Tools` to find the installed MIME::Words version.\n- Check for MIME::Parser or MIME-Tools in your dependencies, e.g. `grep -r \"MIME::Parser\" .` in the application source.","fix":"- Upgrade MIME::Words to `5.521` or later (distributed with MIME-Tools).\n- Until upgraded, limit request or message size before parsing mail.","status":"open","published_at":"2026-10-28T18:17:13+00:00","first_seen_at":"2026-10-28T18:34:33+00:00","triaged_at":"2026-10-28T18:35:26+00:00","updated_at":"2026-10-28T18:35:26+00:00","category":"package","confidence":0.6,"triage":{"at":"2026-10-28T18:35:26Z","model":"claude-haiku-5-5","output":{"fix":"- Upgrade MIME::Words to `5.521` or later (distributed with MIME-Tools).\n- Until upgraded, limit request or message size before parsing mail.","reach":"network","title":"Perl MIME::Words: repeated encoded-word markers exhaust memory during mail parsing","impact":"low","summary":"MIME::Words before 5.521 appends the whole input string to an error variable for each malformed \"=?\" marker, so a crafted header multiplies its size. From 5.518 onward MIME::Parser runs this on every multipart boundary, so one Content-Type header from a remote sender can exhaust the parsing process's memory.","category":"package","nicknames":[],"who_cares":["perl","mime-tools","email-parsing"],"confidence":0.6,"needs_auth":"no","worst_case":"Parsing process runs out of memory and crashes on one crafted header.","analyst_note":"","how_to_check":"- Run `perl -MMIME::Words -e 'print $MIME::Words::VERSION'` or `cpan -l | grep MIME-Tools` to find the installed MIME::Words version.\n- Check for MIME::Parser or MIME-Tools in your dependencies, e.g. `grep -r \"MIME::Parser\" .` in the application source.","needs_analyst":false,"not_affected_if":["no-untrusted-mime-input","versions-before-5.518"],"who_is_affected":"Applications that parse inbound email or multipart content with MIME::Parser from MIME-Tools 5.518 or later, where attacker-controlled Content-Type headers reach the parser. Systems that only generate mail or never parse untrusted MIME input are unlikely to be exposed.","user_interaction":"no","needs_special_setup":"no","severity_if_unknown":"medium"},"cost_usd":0.00065,"input_tokens":3413,"output_tokens":617,"severity_before":"unknown"},"analyst_status":null,"analyst_note":null,"search":"'-116270':16A,19A '-2026':15A,18A '000':122C,125C,129C '128':135C '16':124C '5.518':53B,139C '5.521':31B,84C '8':121C,128C 'add':127C 'allow':87C 'append':32B,108C 'boundari':62B,119C,145C 'byte':126C 'complet':103C 'contain':112C 'content':66B,163C 'content-typ':65B,162C 'copi':130C 'craft':47B 'cve':14A,17A 'decod':94C,106C,142C 'email':21B 'email-pars':20B 'encod':6A,104C 'encoded-word':5A 'error':39B,110C 'everi':60B,143C 'exhaust':9A,74B,89C,153C 'header':48B,68B,165C 'input':35B,115C 'mail':12A 'malform':43B 'marker':8A,44B 'mb':136C 'memori':10A,79B,88C,155C 'messag':111C 'mime':2A,24B,28B,55B,80C,140C 'mime-tool':23B 'mimeword':95C,107C 'multipart':61B,144C 'multipli':49B 'one':64B,161C 'onward':54B 'packag':26B 'pair':123C 'pars':13A,22B,76B,158C 'parser':56B,141C 'perl':1A,27B,86C 'process':77B,159C 'remot':71B,150C 'repeat':4A,91C 'run':57B 'sender':72B,151C 'sequenc':92C 'size':51B 'start':101C 'string':36B,116C 'tool':25B 'type':67B,164C 'variabl':40B 'version':82C,138C 'via':90C 'way':147C 'whole':34B,114C 'word':3A,7A,29B,81C,105C","nicknames":[],"mitigations":[],"who_affected":"Applications that parse inbound email or multipart content with MIME::Parser from MIME-Tools 5.518 or later, where attacker-controlled Content-Type headers reach the parser. Systems that only generate mail or never parse untrusted MIME input are unlikely to be exposed.","tier":"C","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-28T18:17:13+00:00","kev":null,"cvss_vector":null,"cvss_by":null,"poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-116270","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-116270","severity":null,"published_at":"2026-10-28T18:17:13+00:00","modified_at":"2026-10-28T18:17:13+00:00","first_seen_at":"2026-10-28T18:34:33+00:00","fetched_at":"2026-10-28T18:34:33+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}